BEAWebLogic SIP Server. Configuring Network Resources

Transcription

1 BEAWebLogic SIP Server Configuring Network Resources Version 3.0 Revised: December 13, 2006

2 Copyright Copyright BEA Systems, Inc. All Rights Reserved. Restricted Rights Legend This software is protected by copyright, and may be protected by patent laws. No copying or other use of this software is permitted unless you have entered into a license agreement with BEA authorizing such use. This document is protected by copyright and may not be copied photocopied, reproduced, translated, or reduced to any electronic medium or machine readable form, in whole or in part, without prior consent, in writing, from BEA Systems, Inc. Information in this document is subject to change without notice and does not represent a commitment on the part of BEA Systems. THE DOCUMENTATION IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND INCLUDING WITHOUT LIMITATION, ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. FURTHER, BEA SYSTEMS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY REPRESENTATIONS REGARDING THE USE, OR THE RESULTS OF THE USE, OF THE DOCUMENT IN TERMS OF CORRECTNESS, ACCURACY, RELIABILITY, OR OTHERWISE. Trademarks and Service Marks Copyright BEA Systems, Inc. All Rights Reserved. BEA, BEA JRockit, BEA WebLogic Portal, BEA WebLogic Server, BEA WebLogic Workshop, Built on BEA, Jolt, JoltBeans, SteelThread, Top End, Tuxedo, and WebLogic are registered trademarks of BEA Systems, Inc. BEA AquaLogic, BEA AquaLogic Data Services Platform, BEA AquaLogic Enterprise Security, BEA AquaLogic Interaction, BEA AquaLogic Interaction Analytics, BEA AquaLogic Interaction Collaboration, BEA AquaLogic Interaction Content Services, BEA AquaLogic Interaction Data Services, BEA AquaLogic Interaction Integration Services, BEA AquaLogic Interaction Process, BEA AquaLogic Interaction Publisher, BEA AquaLogic Interaction Studio, BEA AquaLogic Service Bus, BEA AquaLogic Service Registry, BEA Builder, BEA Campaign Manager for WebLogic, BEA elink, BEA Kodo, BEA Liquid Data for WebLogic, BEA Manager, BEA MessageQ, BEA SALT, BEA Service Architecture Leveraging Tuxedo, BEA WebLogic Commerce Server, BEA WebLogic Communications Platform, BEA WebLogic Enterprise, BEA WebLogic Enterprise Platform, BEA WebLogic Enterprise Security, BEA WebLogic Express, BEA WebLogic Integration, BEA WebLogic Java Adapter for Mainframe, BEA WebLogic JDriver, BEA WebLogic Log Central, BEA WebLogic Mobility Server, BEA WebLogic Network Gatekeeper, BEA WebLogic Personalization Server, BEA WebLogic Personal Messaging API, BEA WebLogic Platform, BEA WebLogic Portlets for Groupware Integration, BEA WebLogic Real Time, BEA WebLogic RFID Compliance Express, BEA WebLogic RFID Edge Server, BEA WebLogic RFID Enterprise Server, BEA WebLogic Server Process Edition, BEA WebLogic SIP Server, BEA WebLogic WorkGroup Edition, BEA Workshop for WebLogic Platform, BEA Workshop JSP, BEA Workshop JSP Editor, BEA Workshop Struts, BEA Workshop Studio, Dev2Dev, Liquid Computing, and Think Liquid are trademarks of BEA Systems, Inc. Accelerated Knowledge Transfer, AKT, BEA Mission Critical Support, BEA Mission Critical Support Continuum, and BEA SOA Self Assessment are service marks of BEA Systems, Inc. All other names and marks are property of their respective owners.

3 Contents 1. Managing WebLogic SIP Server Network Resources Overview of Network Configuration IPv4 and IPv Configuring Load Balancer Addresses Multiple Load Balancers and Multihomed Load Balancers Enabling DNS Support Configuring Network Channels for SIP or SIPS Reconfiguring an Existing Channel Creating a New SIP or SIPS Channel Configuring Custom Timeout, MTU, and Other Properties Configuring SIP Channels for Multi-Homed Machines Configuring TCP and TLS Channels for Diameter Support Configuring Engine Servers to Listen on Any IP Interface ( or ::) Configuring Unique Listen Address Attributes for Data Tier Replicas Production Network Architectures and WebLogic SIP Server Configuration Overview Single-NIC Configurations with TCP and UDP Channels Static Port Configuration for Outbound UDP Packets Multihomed Server Configurations Overview Multihomed Servers Listening On All Addresses (IP_ANY) Multihomed Servers Listening on Multiple Subnets Understanding the Route Resolver IP Aliasing with Multihomed Hardware Configuring Network Resources iii

4 Load Balancer Configurations Single Load Balancer Configuration Multiple Load Balancers and Multihomed Load Balancers Network Address Translation Options IP Masquerading Alternative to Source NAT Example WebLogic SIP Server Network Configuration Overview Example Network Topology WebLogic SIP Server Configuration Load Balancer Configuration NAT-based configuration maddr-based Configuration Configuring Diameter Client Nodes and Relay Agents Overview of Diameter Protocol Configuration Steps for Configuring Diameter Client Nodes and Relay Agents Installing the Diameter Domain Enabling the Diameter Console Extension Creating TCP, TLS, and SCTP Network Channels for the Diameter Protocol Configuring Two-Way SSL for Diameter TLS Channels Configuring and Using SCTP for Diameter Messaging Configuring Diameter Nodes Creating a New Node Configuration (General Node Configuration) Configuring Diameter Applications Configuring the Sh Client Application Configuring the Rf Client Application Configuring the Ro Client Application iv Configuring Network Resources

5 Configuring a Diameter Relay Agent Configuring the Sh and Rf Simulator Applications Configuring Peer Nodes Configuring Routes Example Domain Configuration Troubleshooting Diameter Configurations Configuring Network Resources v

6 vi Configuring Network Resources

7 CHAPTER 1 Managing WebLogic SIP Server Network Resources The following sections describe how to configure network resources for use with WebLogic SIP Server: Overview of Network Configuration on page 1-1 Configuring Load Balancer Addresses on page 1-3 Enabling DNS Support on page 1-4 Configuring Network Channels for SIP or SIPS on page 1-5 Configuring Custom Timeout, MTU, and Other Properties on page 1-7 Configuring SIP Channels for Multi-Homed Machines on page 1-9 Configuring TCP and TLS Channels for Diameter Support on page 1-9 Configuring Engine Servers to Listen on Any IP Interface ( or ::) on page 1-10 Configuring Unique Listen Address Attributes for Data Tier Replicas on page 1-10 Overview of Network Configuration The default HTTP network configuration for each WebLogic SIP Server instance is determined from the Listen Address and Listen Port setting for each server. However, WebLogic SIP Server does not support the SIP protocol over HTTP. The SIP protocol is supported over the UDP and TCP transport protocols. SIPS is also supported using the TLS transport protocol. Configuring Network Resources 1-1

8 Managing WebLogic SIP Server Network Resources To enable UDP, TCP, or TLS transports, you configure one or more network channels for a WebLogic SIP Server instance. A network channel is a configurable WebLogic Server resource that defines the attributes of a specific network connection to the server instance. Basic channel attributes include: The protocols supported by the connection The listen address (DNS name or IP address) of the connection The port number used by the connection (optional) The port number used by outgoing UDP packets The public listen address (load balancer address) to embed in SIP headers when the channel is used for an outbound connection. You can assign multiple channels to a single WebLogic SIP Server instance to support multiple protocols or to utilize multiple interfaces available with multihomed server hardware. You cannot assign the same channel to multiple server instances. When you configure a new network channel for the SIP protocol, both the UDP and TCP transport protocols are enabled on the specified port. You cannot create a SIP channel that supports only UDP transport or only TCP transport. When you configure a network channel for the SIPS protocol, the server uses the TLS transport protocol for the connection. As you configure a new SIP Server domain, you will generally create multiple SIP channels for communication to each engine tier server in your system. Engine tier servers can communicate to data tier replicas using the configured Listen Address attributes for the replicas. Note, however, that replicas must use unique Listen Addressees in order to communicate with one another. Note: If you configure multiple replicas in a data tier cluster, you must configure a unique Listen Address for each server (a unique DNS name or IP address). If you do not specify a unique Listen Address, the replica service binds to the default localhost address and multiple replicas cannot locate one another. IPv4 and IPv6 If your operating system and hardware support IPv6, you can also configure WebLogic SIP Server to use IPv6 for network communication. IPv6 for SIP traffic is enabled by configuring a network channel with an IPv6 address. You must configure an IPv6 SIP channel on each engine tier server that will support IPv6 traffic. See Creating a New SIP or SIPS Channel on page 1-6 for instructions. 1-2 Configuring Network Resources

9 Configuring Load Balancer Addresses Note that each SIP network channel configured on an engine supports either IPv6 or IPv4 traffic. You cannot mix IPv4 and IPv6 traffic on a single channel. A single engine can be configured with both an IPv4 and IPv6 channel to support multiple, separate networks. It is also possible for WebLogic SIP Server engine and data tier nodes to communicate on IPv4 (or IPv6) while supporting the other protocol version for external SIP traffic. To configure engine and data tier nodes on an IPv6 network, simply specify IPv6 listen addresses for each server instance. See Creating a New SIP or SIPS Channel on page 1-6 for information about configuring IPv4 and IPv6 network channels. Configuring Load Balancer Addresses If your system uses one or more load balancers to distribute connections to the engine tier, you must configure SIP network channels to include a load balancer address as the external listen address. When a SIP channel has an external listen address that differs from the channel s primary listen address, WebLogic SIP Server embeds the host and port number of the external address in SIP headers such as Response. In this way, subsequent communication for the call is directed to the public load balancer address, rather than the local engine tier server address (which may not be accessible to external clients). If a network channel does not have a configured external listen address, the primary listen address is embedded into SIP headers. Multiple Load Balancers and Multihomed Load Balancers If your system uses two load balancers, you must define two channels on each engine tier server (one for each network connection to each load balancer) and assign the external listen address to the corresponding load balancer. When a particular network interface on the engine tier server is selected for outbound traffic, the network channel associated with that NIC s address is examined to determine the external listen address to embed in SIP headers. If your system uses a multihomed load balancer having two public addresses, you must also define a pair of channels to configure both public addresses. If the engine tier server has only one NIC, you must define a second, logical address on the NIC to configure a dedicated channel for the second public address. In addition, you must configure your IP routing policies to define which logical address is associated with each public load balancer address. Configuring Network Resources 1-3

10 Managing WebLogic SIP Server Network Resources Enabling DNS Support WebLogic SIP Server supports DNS for resolving the transport, IP address and port number of a proxy required to send a SIP message. This matches the behavior described in RFC DNS may also used when routing responses in order to resolve the IP address and port number of a destination. WARNING: Because DNS resolution is performed within the context of SIP message processing, any DNS performance problems result in increased latency performance. BEA recommends using a caching DNS server in a production environment to minimize potential performance problems. To configure DNS support: 1. Log in to the Administration Console for the WebLogic SIP Server domain you want to configure. 2. Click Lock & Edit to obtain a configuration lock. 3. Select the SipServer node in the left pane of the Console. 4. Select the Configuration->General tab in the right pane. 5. Select Enable DNS Server Lookup. 6. Click Save to save your changes. 7. Click Activate Changes to apply the configuration. When you enable DNS lookup, the server can use DNS to: Discover a proxy server s transport, IP address, and port number when a request is sent to a SIP URI. Resolve an IP address and/or port number during response routing, depending on the contents of the Sent-by field. For proxy discovery, WebLogic SIP Server uses DNS resolution only once per SIP transaction to determine transport, IP, and port number information. All retransmissions, ACKs, or CANCEL requests are delivered to the same address and port using the same transport. For details about how DNS resolution takes place, see RFC 3263: Session Initiation Protocol (SIP): Locating SIP Servers. 1-4 Configuring Network Resources

11 Configuring Network Channels for SIP or SIPS When a proxy needs to send a response message, WebLogic SIP Server uses DNS lookup to determine the IP address and/or port number of the destination, depending on the information provided in the sent-by field and via header. Configuring Network Channels for SIP or SIPS When you create a new domain using the Configuration Wizard, WebLogic SIP Server instances are configured with a default network channel supporting the SIP protocol over UDP and TCP. This default channel is configured to use Listen Port 5060, but specifies no Listen Address. Follow the instructions in Reconfiguring an Existing Channel to change the default channel s listen address or listen port settings. See Creating a New SIP or SIPS Channel on page 1-6 for to create a new channel resource to support additional protocols or additional network interfaces. Reconfiguring an Existing Channel Note: You cannot change the protocol supported by an existing channel. To reconfigure an existing listen address/port combination to use a different network protocol, you must delete the existing channel and create a new channel using the instructions in Creating a New SIP or SIPS Channel on page Log in to the Administration Console for the WebLogic SIP Server domain you want to configure. 2. Click Lock & Edit to obtain a configuration lock. 3. In the left pane, select the Environment->Servers tab. 4. In the right pane, select the name of the server you want to configure. 5. Select the Protocols->Channels tab to display the configured channels. 6. To delete an existing channel, select it in the table and click Delete. 7. To reconfigure an existing channel: a. Select the channel s name from the channel list (for example, the default sip channel). b. Edit the Listen Address or Listen Port fields to correspond to the address of a NIC or logical address on the associated engine tier machine. c. Edit the External Listen Address or External Listen Port fields to match the public address of a load balancer in the system. Configuring Network Resources 1-5

12 Managing WebLogic SIP Server Network Resources d. Edit the advanced channel attributes as necessary (see Creating a New SIP or SIPS Channel on page 1-6 for details.) e. Click Save. 8. Click Activate Changes to apply the configuration. Creating a New SIP or SIPS Channel To create add a new SIP or SIPS channel to the configuration of a WebLogic SIP Server instance: 1. Log in to the Administration Console for the WebLogic SIP Server domain you want to configure. 2. Click Lock & Edit to obtain a configuration lock. 3. In the left pane, select the Environment->Servers tab. 4. In the right pane, select the name of the server you want to configure. 5. Select the Protocols->Channels tab to display the configured channels. 6. Click New to configure a new channel. 7. Fill in the new channel fields as follows: Name: Enter an administrative name for this channel, such as SIPS-Channel-eth0. Protocol: Select either SIP to support UDP and TCP transport, or SIPS to support TLS transport. Note that a SIP channel cannot support only UDP or only TCP transport on the configured port. 8. Click Next 9. Fill in the new channel s addressing fields as follows: Listen Address: Enter the IP address or DNS name for this channel. On a multi-homed machine, enter the exact IP address of the interface you want to configure, or a DNS name that maps to the exact IP address. Listen Port: Enter the port number used to communication via this channel. The combination of Listen Address and Listen Port must be unique across all channels configured for the server. SIP channels support both UDP and TCP transport on the configured port. External Listen Address and External Listen Port: Edit these fields to match the public address of a load balancer associated with this channel. When the server selects 1-6 Configuring Network Resources

13 Configuring Custom Timeout, MTU, and Other Properties an interface or logical address to use for outbound network traffic, WebLogic SIP Server examines the channel that was configured with the same primary Listen Address; if the External Listen Address of this channel differs, the external address is embedded into SIP message headers for further call traffic. See Configuring Load Balancer Addresses on page Click Next 11. Optionally click Show to display and edit advanced channel properties, such as connection timeout values. Keep in mind the following restrictions and suggestions for advanced channel properties: Outbound Enabled This attribute is always enabled, because SIP and SIPS channels can always originate network connections. HTTP Enabled for This Protocol This attribute cannot be used with SIP and SIPS channels, because WebLogic SIP Server does not support HTTP transport over SIP protocols. Maximum Message Size This attribute specifies the maximum TCP message size that the server allows on a connection from this channel. WebLogic SIP Server shuts off any connection where the messages size exceeds the configured value. The default size of 10,000,000 bytes is large. If you are concerned about preventing Denial Of Service (DOS) attacks against the server, reduce this attribute to a value that is compatible with your deployed services. 12. Click Next. 13. Click Activate Changes to apply the configuration. Configuring Custom Timeout, MTU, and Other Properties SIP channels can be further configured using one or more custom channel properties. The custom properties cannot be set using the Administration Console. Instead, you must use a text editor to add the properties to a single, custom-property stanza in the channel configuration portion of the config.xml file for the domain. WebLogic SIP Server provides the following custom properties that affect the transport protocol of SIP channels: TcpConnectTimeoutMillis Specifies the amount of time WebLogic SIP Server waits before it declares a destination address (for an outbound TCP connection) as unreachable. The property is applicable only to SIP channels; WebLogic SIP Server ignores this Configuring Network Resources 1-7

14 Managing WebLogic SIP Server Network Resources attribute value for SIPS channels. A value of 0 disables the timeout completely. A default value of 3000 milliseconds is used if you do not specify the custom property. SctpConnectTimeoutMillis Specifies the amount of time WebLogic SIP Server waits before it declares a destination address (for an outbound STCP connection) as unreachable. The property is applicable only to SCTP channels (for Diameter traffic). A value of 0 disables the timeout completely. A default value of 3000 milliseconds is used if you do not specify the custom property. See Static Port Configuration for Outbound UDP Packets on page 2-4 for information about creating SCTP channels for Diameter. SourcePorts Configures one or more static port numbers that a server uses for originating UDP packets. WARNING: BEA does not recommend using the SourcePorts custom property in most configurations because it degrades performance. Configure the property only in cases where you must specify the exact ports that WebLogic SIP Server uses to originate UDP packets. See for information about using this property. Mtu Specifies the Maximum Transmission Unit (MTU) value for this channel. A value of -1 uses the default MTU size for the transport. EnabledProtocolVersions Specifies the version of the SSL protocol to use with this channel when WebLogic SIP Server acts as an SSL client. When acting as an SSL client, by default the channel requires TLS V1.0 as the supported protocol. The server can be configured to use SSL V3.0 as well, if that is the highest version that the SSL peer servers support. You can set one of the following values for this property: TLS1, the default, configures the channel to send and accept only TLS V1.0 messages. Peers must respond with a TLS V1.0 message, or the SSL connection is dropped. SSL3 configures the channel to send and accept only SSL V3.0 messages. Peers must respond with an SSL V3.0 message, or the SSL connection is dropped. ALL supports either TLS V1.0 or SSL V3.0 messages. Peers must respond with a TLS V1.0 or SSL V3.0 message, or the SSL connection is dropped. To configure a custom property, use a text editor to modify the config.xml file directly, or use a JMX client such as WLST to add the custom property. When editing config.xml directly, ensure that you add only one custom-properties element to the end of a channel s configuration stanza. Separate multiple custom properties within the same element using semicolons (;) as shown in Listing Configuring Network Resources

15 Configuring SIP Channels for Multi-Homed Machines Listing 1-1 Setting Custom Properties <network-access-point> <name>sip</name> <protocol>sip</protocol> <listen-port>5060</listen-port> <public-port>5060</public-port> <http-enabled-for-this-protocol>false</http-enabled-for-this-protocol> <tunneling-enabled>false</tunneling-enabled> <outbound-enabled>true</outbound-enabled> <enabled>true</enabled> <two-way-ssl-enabled>false</two-way-ssl-enabled> <client-certificate-enforced>false</client-certificate-enforced> <custom-properties>enabledprotocolversions=all;mtu=1000;sourceports=50 60</custom-properties> </network-access-point> Configuring SIP Channels for Multi-Homed Machines If you are configuring a server that has multiple network interfaces (a multihomed server), you must configure a separate network channel for each IP address used by WebLogic SIP Server. WebLogic SIP Server uses the listen address and listen port values for each channel when embedding routing information into SIP message system headers. Note: If you do not configure a channel for a particular IP address on a multihomed machine, that IP address cannot be used when populating Via, Contact, and Record-Route headers. Configuring TCP and TLS Channels for Diameter Support WebLogic SIP Server s Diameter implementation supports the Diameter protocol over the TCP or TLS transport protocols. To enable incoming Diameter connections on a server, you configure a dedicated network channel using the protocol type diameter for TCP transport, or diameters for both TCP and TLS transport. The Diameter implementation application may automatically upgrade Diameter connections to use TLS as described in the Diameter specification (RFC 3558). Configuring Network Resources 1-9

16 Managing WebLogic SIP Server Network Resources See Configuring Diameter Client Nodes and Relay Agents on page 4-1 for more information about configuring network channels for Diameter protocol support. Configuring Engine Servers to Listen on Any IP Interface ( or ::) To configure WebLogic SIP Server to listen for UDP traffic on any available IP interface, create a new SIP channel and specify (or :: for IPv6 networks) as the listen address. Note that you must still configure at least one additional channel with an explicit IP address to use for outgoing SIP messages. (For multi-homed machines, each interface used for outgoing messages must have a configured channel.) Note: Note: If you configure a SIP channel without specifying the channel listen address, but you do configure a listen address for the server itself, then the SIP channel inherits the server listen address. In this case the SIP channel does not listen on IP_ANY. Using the configuration affects only UDP traffic on Linux platforms. WebLogic SIP Server only creates TCP and HTTP listen threads corresponding to the configured hostname of the server, and localhost. If multiple addresses are mapped to the hostname, WebLogic SIP Server displays warning messages upon startup. To avoid this problem and listen on all addresses, specify the :: address, which encompasses all available addresses for both IPv6 and IPv4 for HTTP and TCP traffic as well. Configuring Unique Listen Address Attributes for Data Tier Replicas Each replica in the data tier must bind to a unique Listen Address attribute (a unique DNS name or IP address) in order to contact one another as peers. Follow these instructions for each replica to assign a unique Listen Address: 1. Access the Administration Console for the WebLogic SIP Server domain. 2. In the left pane, select the name of the server to configure. 3. Select the Configuration->General tab. 4. Enter a unique DNS name or IP address in the Listen Address field. 5. Click Apply Configuring Network Resources

17 CHAPTER 2 Production Network Architectures and WebLogic SIP Server Configuration The following sections describe common network architectures used in production deployments, and explain how WebLogic SIP Server is configured to run in those architectures: Overview on page 2-1 Single-NIC Configurations with TCP and UDP Channels on page 2-3 Multihomed Server Configurations Overview on page 2-5 Multihomed Servers Listening On All Addresses (IP_ANY) on page 2-6 Multihomed Servers Listening on Multiple Subnets on page 2-6 Understanding the Route Resolver on page 2-7 IP Aliasing with Multihomed Hardware on page 2-8 Load Balancer Configurations on page 2-8 Single Load Balancer Configuration on page 2-9 Multiple Load Balancers and Multihomed Load Balancers on page 2-10 Network Address Translation Options on page 2-10 Overview Most production installations of WebLogic SIP Server are contain one or more of the following characteristics: Configuring Network Resources 2-1

18 Production Network Architectures and WebLogic SIP Server Configuration Multiple engine tier servers arranged in a cluster. Multiple network channels per engine tier server instance, in support of multiple SIP transport protocols or multiple Network Interface Cards (NICs) on multihomed hardware. One or more load balancers, or a multihomed load balancer, performing server failover and possibly Network Address Translation (NAT) for source or destination network packets. A combination of these network elements can make it difficult to understand how elements interact with one another, and how a particular combination of elements or configuration options affects the contents of a SIP message or transport protocol datagram. The sections that follow attempt to describe common WebLogic SIP Server network architectures and explain how servers are configured in each architecture. The sections also explain how information in SIP messages and transport datagrams is affected by each configuration. Figure 2-1 shows the typical Open Systems Interconnect (OSI) model layers that can be affected by different network configurations. Figure 2-1 OSI Layers Affected by WebLogic SIP Server Network Configuration Layer 3 (Network) and Layer 4 (Transport) contain the source or destination IP address and port numbers for both outgoing and incoming transport datagrams. Layer 7 (Application) may also be affected because the SIP protocol specifies that certain SIP headers include addressing information for contacting the sender of a SIP message. 2-2 Configuring Network Resources

19 Single-NIC Configurations with TCP and UDP Channels Single-NIC Configurations with TCP and UDP Channels In a simple network configuration for a server having a single NIC, one or more network channels may be created to support SIP messages over UDP and TCP, or SIPS over TLS. It is helpful to understand how this simple configuration affects information in the OSI model, so that you can understand how more complex configurations involving multihomed hardware and load balancers affect the same information. Figure 2-2 Single-NIC Network Channel Configuration Figure 2-2 shows a single engine tier server instance with a single NIC. The server is configured with one network channel supporting SIP over UDP and TCP. (SIP channels always support both UDP and TCP transports; you cannot support only one of the two.) Figure 2-2 also shows two clients communicating with the server, one over UDP and one over TCP. For the TCP transport, the outgoing datagram (delivered from WebLogic SIP Server to the UA) contains the following information: Layer 3 includes the source IP address specified by the network channel ( in the example above). Layer 4 includes the source port number allocated by the underlying operating system. Incoming TCP datagrams (delivered from the UA to WebLogic SIP Server) contain the following information: Configuring Network Resources 2-3

20 Production Network Architectures and WebLogic SIP Server Configuration Layer 3 includes the destination IP address specified by the network channel ( ). Layer 4 contains the destination port number specified by the network channel (5060). For outgoing UDP datagrams, the OSI layer information contains the same information as with TCP transport. For incoming UDP datagrams, the OSI layer information is the same as TCP except in the case of incoming datagram Layer 4 information. For incoming UDP datagrams, Layer 4 contains either: The destination port number specified by the network channel (5060), or The ephemeral port number previously allocated by WebLogic SIP Server. By default WebLogic SIP Server allocates ports from the ephemeral port number range of the underlying operating system for outgoing UDP datagrams. WebLogic SIP Server allows external connections to use an ephemeral point as the destination port number, in addition to the port number configured in the network channel. In other words, WebLogic SIP Server automatically listens on all ephemeral ports that the server allocates. You can optionally disable WebLogic SIP Server s use of ephemeral port numbers by specifying the following option when starting the server: -Dwlss.udp.listen.on.ephemeral=false You can determine WebLogic SIP Server s use of a particular ephemeral port by examining the server log file: <Nov 30, :00:00 AM PDT> <Notice> <WebLogicServer> <BEA > <Thread SIP Message Processor (Transport UDP) listening on port > Static Port Configuration for Outbound UDP Packets WebLogic SIP Server network channels provide a SourcePorts attribute that you can use to configure one or more static ports that a server uses for originating UDP packets. WARNING: BEA does not recommend using the SourcePorts custom property in most configurations because it degrades performance. Configure the property only in cases where you must specify the exact ports that WebLogic SIP Server uses to originate UDP packets. To configure the SourcePorts property, use a JMX client such as WLST or directly modify a network channel configuration in config.xml to include the custom property. SourcePorts defines an array of port numbers or port number ranges. Do not include spaces in the SourcePorts definition - use only port numbers, hyphens ( - ) to designate ranges of ports, and commas (, ) to separate ranges or individual ports. See Listing 2-1 for an example configuration. 2-4 Configuring Network Resources

21 Multihomed Server Configurations Overview Listing 2-1 Static Port Configuration for Outgoing UDP Packets <network-access-point> <name>sip</name> <protocol>sip</protocol> <listen-port>5060</listen-port> <public-port>5060</public-port> <http-enabled-for-this-protocol>false</http-enabled-for-this-protocol> <tunneling-enabled>false</tunneling-enabled> <outbound-enabled>true</outbound-enabled> <enabled>true</enabled> <two-way-ssl-enabled>false</two-way-ssl-enabled> <client-certificate-enforced>false</client-certificate-enforced> <custom-properties>sourceports=5060</custom-properties> </network-access-point> Multihomed Server Configurations Overview Engine tier servers in a production deployment frequently utilize multihomed server hardware, having two or more NICs. Multihomed hardware is typically used for one of the following purposes: To provide redundant network connections within the same subnet. Having multiple NICs ensures that one or more network connections are available to communicate with data tier servers or the Administration Server, even if a single NIC fails. To support SIP communication across two or more different subnets. For example WebLogic SIP Server may be configured to proxy SIP requests from UAs in one subnet to UAs in a second subnet, when the UAs cannot directly communicate across subnets. The configuration requirements and OSI layer information differ depending on the use of multihomed hardware in your system. When multiple NICs are used to provide redundant connections within a subnet, servers are generally configured to listen on all available addresses (IP_ANY) as described in Multihomed Servers Listening On All Addresses (IP_ANY) on page 2-6. Configuring Network Resources 2-5

22 Production Network Architectures and WebLogic SIP Server Configuration When using multiple NICs to support different subnets, you must configure multiple network on the server for each different NIC as described in Multihomed Servers Listening on Multiple Subnets on page 2-6. Multihomed Servers Listening On All Addresses (IP_ANY) The simplest multihome configuration enables a WebLogic SIP Server instance to listen on all available NICs (physical NICs as well as logical NICs), sometimes described as IP_ANY. To accomplish this, you simply configure a single network channel and specify a channel listen address of Note that you must configure the address directly on the server s network channel. If you specify no IP address in the channel, the channel inherits the listen address configured for the server instance itself. See Configuring Engine Servers to Listen on Any IP Interface ( or ::) on page Multihomed Servers Listening on Multiple Subnets Multiple NICs can also be used in engine tier servers to listen on multiple subnets. The most common configuration uses WebLogic SIP Server to proxy SIP traffic from one subnet to another where no direct access between subnets is permitted. Figure 2-3 shows this configuration. 2-6 Configuring Network Resources

23 Multihomed Servers Listening on Multiple Subnets Figure 2-3 Multihomed Configuration for Proxying between Subnets To configure the WebLogic SIP Server instance in Figure 2-3 you must define a separate network channel for each NIC used on the server machine. Listing 2-2 shows the config.xml entries that define channels for the sample configuration. Listing 2-2 Sample Network Channel Configuration for NICs on Multiple Subnets <NetworkAccessPoint ListenAddress= ListenPort="5060" Name="sipchannelA" Protocol="sip"/> <NetworkAccessPoint ListenAddress= ListenPort="5060" Name="sipchannelB" Protocol="sip"/> Understanding the Route Resolver When WebLogic SIP Server is configured to listen on multiple subsets, a feature called the route resolver is responsible for the following activities: Populating OSI Layer 7 information (SIP system headers such as Via, Contact, and so forth) with the correct address. Configuring Network Resources 2-7

24 Production Network Architectures and WebLogic SIP Server Configuration Populating OSI Layer 3 information with the correct source IP address. For example, in the configuration shown in Figure 2-3, WebLogic SIP Server must add the correct subnet address to SIP system headers and transport datagrams in order for each UA to continue processing SIP transactions. If the wrong subnet is used, replies cannot be delivered because neither UA can directly access the other UA s subnet. The route resolver works by determining which NIC the operating system will use to send a datagram to a given destination, and then examining the network channel that is associated with that NIC. It them uses the address configured in the selected network channel to populate SIP headers and Layer 3 address information. For example, in the configuration shown in Figure 2-3, an INVITE message sent from WebLogic SIP Server to UAC B would have a destination address of The operating system would transmit this message using NIC B, which is configured for the corresponding subnet. The route resolver associates NIC B with the configured sipchannelb and embeds the channel s IP address ( ) in the VIA header of the SIP message. UAC B then uses the VIA header to direct subsequent messages to the server using the correct IP address. A similar process is used for UAC A, to ensure that messages are delivered only on the correct subnet. IP Aliasing with Multihomed Hardware IP aliasing assigns multiple logical IP addresses to a single NIC, and is configured in the underlying server operating system. If you configure IP aliasing and all logical IP addresses are within the same subnet, you can simply configure WebLogic SIP Server to listen on all addresses as described in Multihomed Servers Listening On All Addresses (IP_ANY) on page 2-6. If you configure IP aliasing to create multiple logical IP addresses on different subnets, you must configure a separate network channel for each logical IP address. In this configuration, WebLogic SIP Server treats all logical addresses as separate physical interfaces (NICs) and uses the route resolver to populate OSI Layer 4 and Layer 7 information based on the configured channel. Load Balancer Configurations In addition to providing failover capabilities and distributing the client load across multiple servers, a load balancer is also an important tool for configuring the network information transmitted between clients and servers. The sections that follow describe common load balancer configurations used with WebLogic SIP Server. 2-8 Configuring Network Resources

25 Load Balancer Configurations Single Load Balancer Configuration The most common load balancer configuration utilizes a single load balancer that gates access to a cluster of engine tier servers, as shown in Figure 2-4. Figure 2-4 SIngle Load Balancer Configuration To configure WebLogic SIP Server for use with a single load balancer as in Figure 2-4, configure one or more network channels for each server, and configure the public address of each channel with the Virtual IP address of the load balancer. In this configuration, WebLogic SIP Server embeds the load balancer IP address in SIP message system headers to ensure that clients can reach the cluster for subsequent replies. Managing WebLogic SIP Server Network Resources on page 1-1 presents detailed steps for configuring network channels with load balancer addresses. Note: Although some load balancing switches can automatically re-route all SIP messages in a given call to the same engine tier server, this functionality is not required with WebLogic SIP Server installations. See Alternate Configurations in Configuring WebLogic SIP Server for more information. Configuring Network Resources 2-9

26 Production Network Architectures and WebLogic SIP Server Configuration Multiple Load Balancers and Multihomed Load Balancers Multiple load balancers (or a multihomed load balancer) can be configured to provide several virtual IP addresses for a single WebLogic SIP Server cluster. To configure WebLogic SIP Server for use with a multihomed load balancer, you create a dedicated network channel for each load balancer or local server NIC, and set the channel s public address to the virtual IP address of the appropriate load balancer. In this configuration, the route resolver associates a configured channel with the NIC used for originating SIP messages. The public address of the selected channel is then used for populating SIP system messages. See Understanding the Route Resolver on page 2-7. Network Address Translation Options In the most common case, a load balancer is configured using destination NAT to provide a public IP address that clients use for communicating with one or more internal (private) WebLogic SIP Server addresses. Load balancers may also be configured using source NAT, which modifies the Layer 3 address information originating from a private address to match the virtual IP address of the load balancer itself. With the default route resolver behavior, a WebLogic SIP Server engine originates UDP packets having a source IP address that matches the address of a local NIC (the private address). This can be problematic for applications that try to respond directly to the Layer 3 address embedded in the transport packet, because the local server address may not be publicly accessible. If your applications exhibit this problem, BEA recommends that you configure the load balancer to perform source NAT to change the transport Layer 3 address to a publicly-accessible virtual IP address. IP Masquerading Alternative to Source NAT WARNING: Using the WebLogic SIP Server IP masquerading functionality can lead to network instability, because it requires duplicate IP addresses on multiple servers. Production deployments must use a load balancer configured for source NAT, rather than IP masquerading, to ensure reliable network performance. If you choose not to enable source NAT on your load balancer, WebLogic SIP Server provides limited IP masquerading functionality. To use this functionality, configure a logical address on each engine tier server using the public IP address of the load balancer for the cluster. (Duplicate the same logical IP address on each engine tier server machine). When a local server interface matches the IP address of a configured load balancer (defined in the public address of a network 2-10 Configuring Network Resources

27 Load Balancer Configurations channel), WebLogic SIP Server uses that interface to originate SIP UDP messages, and the Layer 3 address contains a public address. You can disable WebLogic SIP Server s IP masquerading functionality by using the startup option: -Dwlss.udp.lb.masquerade=false Configuring Network Resources 2-11

28 Production Network Architectures and WebLogic SIP Server Configuration 2-12 Configuring Network Resources

29 CHAPTER 3 Example WebLogic SIP Server Network Configuration The following sections describe a sample network configuration for WebLogic SIP Server using a non-sip-aware load balancer: Overview on page 3-1 Example Network Topology on page 3-1 WebLogic SIP Server Configuration on page 3-2 Load Balancer Configuration on page 3-3 Overview WebLogic SIP Server is compatible with load balancers that are not SIP-aware, meaning that they do not consider existing SIP dialogues when routing requests to servers. This document demonstrates load balancer and WebLogic SIP Server configuration, as well as SIP and Network Address Translation (NAT) interactions in various configurations. For more information about implementation-dependent issues surrounding NAT see the IETF document, NAT Behavioral Requirements for Unicast UDP. Example Network Topology Figure 3-1 shows the sample network topology described in this section. A WebLogic SIP Server cluster, consisting of engines WLSS 1 and WLSS 2, is configured on private IP network 10.1/16 Configuring Network Resources 3-1

30 Example WebLogic SIP Server Network Configuration (an internal 16-bit subnet). The cluster's public IP address is , which is the virtual IP address configured on the load balancer. The User Agent, UAC A, with IP address never sees the internal IP addresses configured for the WebLogic SIP Server cluster. Instead, it sends requests to, and receives responses from The sections that follow discuss configuring the WebLogic SIP Server cluster and load balancer for this example system. Figure 3-1 Example Network Topology WebLogic SIP Server Configuration The WebLogic SIP Server cluster configuration specifies the public address as , and the public port as 5060 (see Configuring Load Balancer Addresses on page 1-3) for each engine. The default route on both WebLogic SIP Server engines points to the load balancer's 10.1/16 network interface: The WebLogic SIP Server (servers WLSS 1 and WLSS 2) routing table is shown in Listing 3-1. Listing 3-1 WebLogic SIP Server Routing Table $ /sbin/route 3-2 Configuring Network Resources

31 Load Balancer Configuration Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface * U eth0 default UG 0 0 Load Balancer Configuration The load balancer is configured with a virtual IP address of , and two real servers, WLSS 1 and WLSS 2, having addresses and , respectively. The load balancer also has an internal IP address of configured on the 10.1/16 network. The UAC address, , is reachable from the load balancer by static route configuration on the load balancer. The load balancer routing table is shown in Listing 3-2. Listing 3-2 Load balancer Routing Table $ /sbin/route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface * U eth * U 0 0 Because the SIP protocol specification (RFC 3261) dictates the destination IP address and UDP port numbers that user agents must use when sending requests or responses, the NAT configuration of the load balancer must be done in a way that does not violate RFC 3261 requirements. Two setup options can be used to accomplish this configuration: NAT-based configuration maddr-based Configuration The sections that follow describe each approach. Configuring Network Resources 3-3

32 Example WebLogic SIP Server Network Configuration NAT-based configuration The default UDP NAT behavior for load balancers is to perform destination IP address translation in the public->private network direction, and source IP address translation in the private->public network direction. This means setting up destination address translation in the UAC->WebLogic SIP Server ( > ) direction without source address translation, and source address translation in the WebLogic SIP Server->UAC (10.1/16-> ) direction without destination address translation. Figure 3-2 illustrates the UDP packet flow for a SUBSCRIBE/200OK transaction. Figure 3-2 SUBSCRIBE Sequence A LB WLSS (1) SUBSCRIBE > ( > ) (2) SUBSCRIBE > ( > ) (3) 200 OK < ( > ) (4) 200 OK < ( > ) Note that the source and destination IP addresses of the UDP packets are shown in blue. In the UAC->WebLogic SIP Server direction, the load balancer translates the destination IP address but not the source IP address. In the WebLogic SIP Server->UAC direction, the load balancer translates the source IP address but not the destination IP address. The complete message trace (including IP and UDP headers, as well as the SIP payload) for the sequence from Figure 3-2 is shown in Listing 3-3 below. 3-4 Configuring Network Resources